Creepy video shows how easy it is to hack a train toilet

From phones to cars and even refrigerators, it seems that any device containing a computer chip is vulnerable to hacking or tampering.

Now an expert has added another item to the long list.

In a new video, software engineer Hugo Landau, based in St Albans, Hertfordshire, easily disrupts the automated locking system of a train toilet.

He says the toilet door can be closed and locked when no one is in it, making it inaccessible.

Fortunately, the hack takes place when the attacker is in the booth, so other passengers don’t have to worry about opening the door while they’re inside.

Although he did not specify the itinerary, Mr Landau said he was on a British Rail Class 800 train, built by Japanese firm Hitachi for Great Western Railway.

“I locked an open door,” Mr. Landau can be heard saying in his video uploaded to YouTube.

“If I were to walk out here right now, this door would be locked.”

When he finally leaves the restroom, he exclaims, “Oh my god! I broke it.”

As anyone who has ever ridden one knows, modern trains in Britain have large disabled toilets with electrically operated doors.

When entering the toilet, users must press the lock button to close the sliding door, before turning a metal lever to the right to lock the door.

Only when the handle is turned to the right to ‘unlock’ can the doors be opened.

Once they have finished their work, they must turn the handle counterclockwise to the ‘unlock’ position and press the other button to open the door.

Mr. Landau was able to disrupt the system because, as he explains in a blog postIt is not a ‘real’ lever connected to a traditional locking mechanism.

Instead, a microcontroller – a small computer on a single integrated circuit – detects whether the lever is in the ‘lock’ or ‘unlock’ position.

Usually a small metal pin on the left side prevents the handle from being turned to the right to ‘lock’ when the toilet door is open.

However, as Mr Landau demonstrates, users can move the lever so that the locking pin cannot engage, but not so far to the right that the lever is set to ‘lock’.

This allows the door to be locked even when it is open.

As Mr. Landau also shows, users can press the button to close the door and quickly jump out, leaving the toilet locked and inaccessible from the outside.

Mr Landau called this a ‘denial-of-service’ (DoS) attack – defined as a malicious attempt to overwhelm and disable an online service.

“Since I could do this and then jump out before the door closes, this is essentially a DoS vulnerability for the toilet on a train,” he said.

He tested the vulnerability several times, but in the last time (shown in his video) he confused the toilet door so much that it decided “fuck this” and went into disable mode,” he said.

He told MailOnline: ‘Some people have misinterpreted the video and thought I was actually trying to make the toilet inaccessible, rather than just showing that it was possible – that is absolutely not the case.

‘I also demonstrated this only because I could do so without bothering anyone; it was quiet on the train, there was no one around and there were several toilets anyway.’

Mr Landau – who works for the OpenSSL software library – describes himself as a ‘hacker and reverse engineer’.

“I believe that computers should be under the control of their owners and no one else – in a world that seems to be moving in the opposite direction,” he says.

“The idea of ​​hardware that the individual user can trust to be on their side has never been more important or in danger.

‘Amusingly, this isn’t the first DoS vulnerability I’ve encountered on a train – but that will have to wait for another article.’

MailOnline has contacted Great Western Railway for comment.